I've been running into a similar-ish problem which involves someone creating a bunch of gmail accounts and linking my account to it. Whenever that happens, Google sends me an email notifying me with an option to remove the linking. However, since I never initiated that action to begin with, I start worrying that the email could be a phishing attempt, so I don't click any of the links. But as a result, I start getting email notifications whenever someone logs to those accounts from random countries on random phones.

Lately they've started creating Facebook accounts with my email. Despite me not verifying the email, Facebook continues to send me login notifications.

Has this happened to anyone? I don't quite understand the attack vector, but my guess is that they're trying to bomb me with notifications and if/when they start realizing that I'm clicking on the links in the notification emails, they can start sending out phishing emails with malicious URLs.